[webkit-reviews] review denied: [Bug 130539] REGRESSION(r164205): WebKit crash @StructureIDTable::get : [Attachment 229700] the patch.

[bugzilla-daemon at webkit.org]

Filip Pizlo <fpizlo at apple.com> has denied Mark Lam <mark.lam at apple.com>'s
request for review:
Bug 130539: REGRESSION(r164205): WebKit crash @StructureIDTable::get
https://bugs.webkit.org/show_bug.cgi?id=130539

Attachment 229700: the patch.
https://bugs.webkit.org/attachment.cgi?id=229700&action=review

------- Additional Comments from Filip Pizlo <fpizlo at apple.com>
View in context: https://bugs.webkit.org/attachment.cgi?id=229700&action=review


> Source/JavaScriptCore/dfg/DFGOSREntry.cpp:249
> +    for (unsigned i = baselineFrameSize; i--;) {

This is wrong - at this point we have shuffled to using the DFG's local
numbering. So we want frameSize here.